Add cert-manager support#196
Add cert-manager support#196Jakob-Naucke wants to merge 9 commits intotrusted-execution-clusters:mainfrom
Conversation
|
Skipping CI for Draft Pull Request. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: Jakob-Naucke The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
@Jakob-Naucke do I understand correctly that we have a single certificate for all the services? |
|
@alicefr no, see e.g. |
register-server falls back to a Kind-shaped AK registration URL when none is provided. Keep Kind-isms out of redistributable operator code, and drop the "enabled" toggle in the TEC CRD -- just rely on the specified address when present. Do not assume a protocol (HTTP/HTTPS) for it. Do not specify the endpoint (`/ak-register`), and thus do not refer to a URL until it becomes one. Stop patching Ignition in tests. Signed-off-by: Jakob Naucke <jnaucke@redhat.com>
Jakob-Naucke
force-pushed
the
kbs-cert
branch
from
80516f5 to
83b4c87
Compare
Jakob-Naucke
force-pushed
the
kbs-cert
branch
from
83b4c87 to
249f9b0
Compare
|
Moving out of draft, includes #207 for now |
Warp is outsourcing multiple features with its move to Hyper v1 that we used or were soon going to use: - Client info like IP - Native TLS support These features are more broadly integrated in Axum, which kube-rs also recently moved to. Signed-off-by: Jakob Naucke <jnaucke@redhat.com> Assisted-by: Claude
Signed-off-by: Jakob Naucke <jnaucke@redhat.com> Assisted-by: Claude
Signed-off-by: Jakob Naucke <jnaucke@redhat.com>
In the trustedexecutioncluster CRD, add optional secret name for a cert-manager shaped certificate. In testing, use cert-manager to create a certificate. Signed-off-by: Jakob Naucke <jnaucke@redhat.com>
Signed-off-by: Jakob Naucke <jnaucke@redhat.com> Assisted-by: Claude
Signed-off-by: Jakob Naucke <jnaucke@redhat.com>
Signed-off-by: Jakob Naucke <jnaucke@redhat.com> Assisted-by: Claude
Signed-off-by: Jakob Naucke <jnaucke@redhat.com>
Jakob-Naucke
force-pushed
the
kbs-cert
branch
from
249f9b0 to
9d5e964
Compare
|
@Jakob-Naucke: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
3 participants
cc @alicefr. Haven't written docs yet but you can get an idea of where it's going by looking at
api/trusted-cluster-gen.go,test_utils::set_certificates.Doesn't include verification for attestation key register. I used the same method as for register server, but I was under the impression the root certificate added in Ignition, which works for the merge from register server, isn't loaded at that time?
Didn't bother too much because that flow is subject to updates.
Fixes: #2
(at which I took first looks when it was new, hence the longest commit timespan in a PR from me to date)